Add a hint about certificate validity, moving some things around

[dcpomatic.git] / src / lib / config.cc

diff --git a/src/lib/config.cc b/src/lib/config.cc
index 0d70c16fc4d493cdd19e84ae1f9bb3d16c950d71..bab15ecb705768025d00e58c3e2bf7ebd4982761 100644 (file)
--- a/src/lib/config.cc
+++ b/src/lib/config.cc
@@ -204,6 +204,7 @@ Config::create_certificate_chain ()
 {
        return make_shared<dcp::CertificateChain> (
                openssl_path(),
+               CERTIFICATE_VALIDITY_PERIOD,
                "dcpomatic.com",
                "dcpomatic.com",
                ".dcpomatic.smpte-430-2.ROOT",
@@ -449,28 +450,14 @@ try
                }
        }
 
-       optional<BadReason> bad;
-
-       for (auto const& i: _signer_chain->unordered()) {
-               if (i.has_utf8_strings()) {
-                       bad = BAD_SIGNER_UTF8_STRINGS;
-               }
-       }
-
-       if (!_signer_chain->chain_valid() || !_signer_chain->private_key_valid()) {
-               bad = BAD_SIGNER_INCONSISTENT;
-       }
-
-       if (!_decryption_chain->chain_valid() || !_decryption_chain->private_key_valid()) {
-               bad = BAD_DECRYPTION_INCONSISTENT;
-       }
-
+       auto bad = check_certificates ();
        if (bad) {
                auto const remake = Bad(*bad);
                if (remake && *remake) {
                        switch (*bad) {
                        case BAD_SIGNER_UTF8_STRINGS:
                        case BAD_SIGNER_INCONSISTENT:
+                       case BAD_SIGNER_VALIDITY_TOO_LONG:
                                _signer_chain = create_certificate_chain ();
                                break;
                        case BAD_DECRYPTION_INCONSISTENT:
@@ -1465,3 +1452,29 @@ Config::add_custom_language (dcp::LanguageTag tag)
        }
 }
 
+
+optional<Config::BadReason>
+Config::check_certificates () const
+{
+       optional<BadReason> bad;
+
+       for (auto const& i: _signer_chain->unordered()) {
+               if (i.has_utf8_strings()) {
+                       bad = BAD_SIGNER_UTF8_STRINGS;
+               }
+               if ((i.not_after().year() - i.not_before().year()) > 15) {
+                       bad = BAD_SIGNER_VALIDITY_TOO_LONG;
+               }
+       }
+
+       if (!_signer_chain->chain_valid() || !_signer_chain->private_key_valid()) {
+               bad = BAD_SIGNER_INCONSISTENT;
+       }
+
+       if (!_decryption_chain->chain_valid() || !_decryption_chain->private_key_valid()) {
+               bad = BAD_DECRYPTION_INCONSISTENT;
+       }
+
+       return bad;
+}
+